Hello,before Netwitness 11.3, we were using the meta "esa.time" in some
correlation rules with Esper Date-Time Methods.After upgrading to
version 11.3+ we noticed that the "esa.time" does no longer exists and
of course our old rules were no longer de...
Hello,i'm trying to icrease the timeout for SSH session on Netwitness
Appliances following the guide described HERE.The procedure works for
all the Netwitness Aplliances except for the NW Admin Server, because
the default configurations (sshd_config ...
Hello, i'm trying to pull some logs from a MySQL db (version
5.7.26-0ubuntu0.18.04.1) following the guide Here.I did all the
procedure correctly, downloading the new version of odbc driver
(8.0.16-1.el7.x86_64) and setting up DSN and connector, but w...
Hello,i'm trying to create a custom multiple index feed on Nw 11.2
following the guide described here 000035599 - Creating custom feeds
with multiple indexed meta keys for RSA Security Analytics 10.6.x .As a
first thing i'm using the same .xml and .c...
Hello,i'm interested to know how are connected the nodes inside of the
respond service.Exists inside of netwitness a configuration file that
show these associations?It is also possible to create associations
between incident metadata created ad hoc?T...
Hello Josh, i solved using this path: C:\inetpub\logs\LogFiles\**\*.log
where "**" means all folders within the current folder. Using the path
"C:\inetpub\logs\LogFiles\W3SVC*\*.log" the collection doesn't work,
with both option for "on first connect...
Hello, thanks for the guide provided but i have a question about IIS
collection using NWE Agent. What if i have multiple log folders (like
W3SVC* as you can see in the screenshot)? I already tried using for
example "C:\inetpub\logs\LogFiles\W3SVC*\*....
Hi, i'm thinking of using this solution for some customers that have
just updated to version 11.3, so i'm trying it in my Lab.When i use the
"get-all-system" script, it ends with this errors: 2020-02-17 10:19:08
+0000 | 23843 | Warning: Generation of...
Hi Eric,it's just a try that i want to do because in the future i
probably have to build a custom feed for a customer that works in 11.2
environment.The result should be easy to achieve, i'm just following the
guide here (000035599 - Creating custom ...
